The 36 checks, and what each category is looking for
Conformance is an automated audit of a storefront against the protocol. It
scores five categories and weights them into one composite from 0 to 100. This
post is what each category actually looks at.
One thing to be clear about first, because the page describing this got it
wrong and so did the post this one replaces. **The checks read data the platform
already holds about your storefront. They do not call your endpoints.** All 36
are database reads. That is why a run is quick and why it cannot be used as an
uptime probe: a check named "Health endpoint active" is reading whether requests
were recorded in the last 30 days, not making one.
It replaces an earlier post on the same subject, which has been retracted. That
one said the engine ran 47 protocol conformance checks in three timed phases.
It runs 9, in one of five weighted categories, and nothing has ever timed a run.
The five categories
| category | weight | checks |
|---|---|---|
| Protocol compliance | 30 percent | 9 |
| Data quality | 25 percent | 10 |
| Performance | 20 percent | 6 |
| Commerce readiness | 15 percent | 6 |
| Trust and reputation | 10 percent | 5 |
A single check passes at 60 or above. A category score is the mean of its
checks. The composite is the weighted mean of the categories, and it is the only
number compared against a threshold. There are no per category minimums: a weak
category can be carried by strong ones.
Protocol compliance, 30 percent
The largest weight, and the one a storefront controls most directly. It asks
whether the thing is wired up: an active API key exists, a storefront
configuration exists and is active, products are served, a knowledge graph is
built so search can answer, the storefront has received a request in the last
30 days, schema injection succeeds above 80 percent of the time, a secret key
exists for rate limited authenticated access, CORS headers are configured, and
the protocol version is advertised on every response under both the current and
the compatibility header name.
That last one is worth pausing on. Advertising a version under two header names
looks like clutter until a client written against the old name meets a server
that only sends the new one.
Data quality, 25 percent
Ten checks, and they are the ones a merchant is most likely to fail without
noticing: required fields present, descriptions longer than 50 characters,
prices above zero and correctly formatted, at least 10 products, image URLs set,
no duplicate titles, categories assigned, knowledge graph entities covering more
than half the catalogue, schema.org structured data generated, and products
updated within the last 30 days.
None of these is about having a good catalogue. They are about having a
catalogue an agent can read without guessing.
Performance, 20 percent
Average response time under 200ms, p95 under 500ms, uptime above 99 percent
over 30 days, cache hit rate above 50 percent, no 5xx errors in the last 7 days,
and a health endpoint answering in under 50ms.
These are the six. The retracted post added a p99 threshold and a rule capping
storefronts at Silver for missing it. Neither exists.
Commerce readiness, 15 percent
Dynamic pricing configured or explicitly opted out, at least one active offer or
negotiation enabled, at least one active bundle, a storefront configuration
present, a webhook endpoint configured, and at least one completed transaction.
A storefront that only serves a read path can still certify. It scores nothing
in this category and can be carried by the other four, which is the composite
working as intended rather than a loophole.
Trust and reputation, 10 percent
Trust score above 50, no unresolved disputes, average agent feedback above 3.0,
a response to an agent query in the last 24 hours, and no pricing margin
violations in the last 30 days.
The smallest weight, because it is the category a new storefront can do least
about on day one.
Levels, validity and where to read a result
| level | composite |
|---|---|
| Platinum | 90 to 100 |
| Gold | 75 to 89 |
| Silver | 60 to 74 |
| Bronze | 50 to 59 |
Below 50 the run is recorded as failed. Failed is not a level, carries no badge,
has no penalty and there is no limit on re-running.
A certificate is valid for 90 days. There is a job that re-runs certification
for any certificate inside 7 days of expiry, and **it is currently switched
off**: it has not run since 29 August 2026. Until it is turned back on,
expiry is expiry and a re-run is something you start yourself.
A storefront's current certification, if it has one, is on its own storefront
surface and needs no key:
curl "https://cresva.ai/api/storefront/$BRAND_ID/certification"
Every figure above comes from lib/certification.ts, which is the file the
conformance page is generated from. If the two ever disagree,
the file is right and the page is a bug.